Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects network connections to JeetBot/Twitch Enhanced Viewer malicious browser extension infrastructure exfiltrating Twitch OAuth tokens. Apex domains (jeetbot.cc, api.jeetbot.cc) are gated on a token-forwarding indicator to avoid false positives.
Detects network traffic (TLS SNI or HTTP Host) to Firebase domains (firebaseio.com, firebaseapp.com, firebasedatabase.app) associated with Mantax Otax and other Android ransomware families for ransom negotiation chat channels.
Detects network traffic (TLS SNI or HTTP Host) to Firebase domains (firebaseio.com, firebaseapp.com, firebasedatabase.app) associated with Mantax Otax and other Android ransomware families for ransom negotiation chat channels.
Detects a multi-stage authentication bypass attempt against LiteLLM MCP endpoints. The rule tracks an initial malformed Authorization Bearer token request to the /mcp/ endpoint, followed by a server response returning a 200 OK status code accompanied by an 'mcp-session-id' header, confirming the exploitation of CVE-2026-59822.
Detects activity from Anthropic network range across multiple event types
This rule monitors various logs (email, entra, device, graph, cloud) for IP addresses (source or remote) that match a specific CIDR range (160.79.104.0/21). This is typically used to identify traffic originating from or communicating with infrastructure identified as malicious or suspicious by threat intelligence.
Detects inbound emails or URL click events that contain specific keywords associated with the PREY-0058 vishing campaign. These keywords are used to lure victims to attacker-controlled pages designed for credential harvesting or MFA/passkey registration.
This rule monitors network connections, DNS resolutions, and email URLs to detect traffic communicating with a known adversary-in-the-middle (AiTM) phishing infrastructure panel. By correlating security logs, DNS events, and email URL data against this specific indicator of compromise, it identifies potential interaction with phishing sites designed to capture credentials or session tokens.
This rule detects network traffic containing specific API paths or hardcoded tokens known to be associated with suspicious or malicious activity, potentially indicating command-and-control (C2) communication or unauthorized interaction with a web service.
This rule detects outbound network connections from internal devices to a list of known malicious IP addresses associated with adversary command and control infrastructure. The rule specifically monitors connections over common ports, potentially indicating established communication with malicious servers.
Detects anomalous network traffic patterns where internal assets interact with Microsoft Graph API and Entra ID (login.microsoftonline.com) authentication endpoints from distinct external destination IPs within a short time window. This behavior is indicative of potential attacker infrastructure rotation during C2 or post-authentication phases.
Detects outbound network traffic from internal hosts to the Microsoft Graph API (graph.microsoft.com) originating from Python HTTP clients (requests or urllib libraries). This pattern can indicate automated data exfiltration from an internal environment to a cloud-based service, or the use of Microsoft Graph API for command and control purposes.
Detects DNS queries for lookalike domains combining a government/brand-impersonation keyword (as its own label, not a substring) with a disposable TLD used across the IronToll campaign. Dropped the standalone 'digital' keyword, which was generic enough to match ordinary e-commerce domains on the same TLDs.
Detects DNS queries for lookalike domains combining a government/brand-impersonation keyword (as its own label, not a substring) with a disposable TLD used across the IronToll campaign. Dropped the standalone 'digital' keyword, which was generic enough to match ordinary e-commerce domains on the same TLDs.
Detects country-coded lure path requests (/eg, /ma) followed by a cloaking differential response (desktop UA blocked with 404, mobile UA served content). Fixed a regex bug where the original pattern matched any path merely starting with 'eg' or 'ma' (e.g. /egg.jpg, /mail, /manifest.json) instead of the exact path segment.
This rule monitors TLS traffic for a specific combination of certificate issuer Common Name (CN) matching 'YE1' and Server Name Indication (SNI) hostnames using known disposable or high-risk top-level domains (TLDs). This behavior is associated with the IronToll campaign, often indicative of command-and-control communication or malicious infrastructure staging.
Detects anomalous command-line arguments and process injection behaviors associated with the Sogou IME protocol handler (biz_helper.exe). The rule monitors for malicious argument injection (e.g., embedded scripts, URLs pointing to non-Sogou domains) and correlates these events with suspicious child processes or network activity, consistent with techniques observed in the GRAYRABBIT / UNC3569 threat activity.
Detects a sequence of events where a user visits a Cloudflare Pages URL (*.pages.dev) and shortly after, a suspicious command (mshta, powershell, or curl) is executed. This pattern is consistent with the UNC5142 threat actor's TTP of using social engineering lures hosted on Cloudflare Pages to trick users into running malicious commands.
This rule detects OAuth authorization requests (targeting Microsoft or Google identity providers) that use 'prompt=none' (silent authentication) and redirect the user to an unexpected or untrusted domain. This pattern is commonly used in OAuth consent phishing or token theft attacks, where an attacker attempts to silently acquire an authorization code by redirecting it to a malicious application server instead of the legitimate service provider's domain.
This rule detects potential VNC remote access activity by identifying systems that exhibit both the presence of specific VNC configuration/history files (AccInfo.ini, History.txt) and concurrent network activity on port 10635, which is commonly associated with VNC-like remote access tools.
Detects network activity (DNS lookups, TLS SNI, and HTTP Host headers) associated with proxy infrastructure (iproyal.com and lightningproxies.net) known to be used by the HEAVYGRAM/CHOSEN BRICK threat actors to mask Telegram-based command and control traffic.
Page 69 of 246